Vercel Valued At 93 Billion Amid Surge In Investor Confidence
Vercel, a leading artificial intelligence (AI) startup, has achieved a remarkable milestone in its …
30. September 2025
Cloud Computing Enclaves Face Growing Vulnerability Threat
The Integrity of Trusted Execution Enclaves: A Growing Concern for Network Security
In the rapidly evolving landscape of cloud computing, network security has become increasingly challenging to ensure the confidentiality and integrity of sensitive data. Two key components of modern network security – Intel’s SGX (Software Guard Extensions) and AMD’s SEV-SNP (Secure Virtualized Environment for Server Platforms) – have been compromised by researchers, who have independently developed attacks capable of breaching these trusted execution enclaves.
SGX and SEV-SNP are designed to provide a high level of security and isolation for sensitive data and processes. By storing certain data and operations within encrypted enclaves, these protections aim to safeguard secrets stored in the cloud by major communication platforms like Signal Messenger and WhatsApp. All prominent cloud providers recommend the use of SGX or SEV-SNP to ensure the confidentiality and integrity of their customers’ data.
Intel’s SGX has been widely adopted across various industries, including finance, healthcare, and government. It provides a secure environment for sensitive data to be processed and stored, without compromising the security of surrounding systems. AMD’s SEV-SNP offers similar protection, but with a slightly different approach. While both protections have gained widespread acceptance, researchers have repeatedly demonstrated that they are not foolproof.
In recent years, numerous attacks have exposed vulnerabilities in SGX and SEV-SNP. Researchers have successfully breached these enclaves using various techniques, including exploiting weaknesses in the deterministic encryption used by both platforms. This deterministic encryption method produces the same ciphertext each time a given plaintext is encrypted with a specific key. In SGX and SEV-SNP, this means that the same plaintext written to the same memory address always yields the same ciphertext.
The latest attacks, dubbed Battering RAM and Wiretap, demonstrate the limitations of these protections in preventing physical attacks. Both attacks rely on an interposer – a small piece of hardware that sits between the CPU silicon and the memory module – which allows attackers to observe data as it passes from one to the other. This position enables the interposer to intercept sensitive information and exploit weaknesses in SGX and SEV-SNP.
Battering RAM, the first attack, defeats both SGX and SEV-SNP by exploiting a specific vulnerability in the deterministic encryption used by these protections. The attackers use an interposer to observe the data written to a memory address, which allows them to predict the ciphertext produced by the encryption algorithm. By doing so, they can intercept sensitive information without needing to know the encryption key.
Wiretap, on the other hand, is a passive attack that relies on observing the encrypted data passing through the interposer. The attackers use this intercepted data to decrypt sensitive information protected by SGX or SEV-SNP. This attack is particularly concerning, as it allows attackers to passively decrypt data without leaving any traces.
The implications of these attacks are far-reaching and significant. If an attacker can breach the security of a trusted execution enclave, they gain access to sensitive data and operations that were previously thought to be secure. This compromise could have serious consequences for organizations relying on SGX or SEV-SNP to safeguard their confidential information.
In response to these findings, Intel and AMD have acknowledged the limitations of their protections and expressed their commitment to addressing these vulnerabilities. Both companies are actively working with researchers and industry partners to strengthen the security of their respective protections.
The development of new attacks against SGX and SEV-SNP serves as a reminder of the ongoing cat-and-mouse game between security researchers and those seeking to breach network protections. As technology continues to evolve, it is essential that these protections remain robust and secure.
In the context of cloud computing, the integrity of trusted execution enclaves like SGX and SEV-SNP cannot be overstated. These protections are a critical component of modern network security, providing a high level of isolation and confidentiality for sensitive data and operations. While researchers have demonstrated vulnerabilities in these protections, it is essential to acknowledge that these findings also highlight the importance of ongoing research and development in this field.
As the use of cloud-based services continues to grow, so too will the demand for robust network security measures like SGX and SEV-SNP. Organizations must ensure that they are taking proactive steps to address vulnerabilities in their protection mechanisms and stay ahead of emerging threats.
The compromise of Intel’s SGX and AMD’s SEV-SNP by researchers highlights the ongoing importance of network security in today’s digital landscape. While these protections have been widely adopted across various industries, it is essential that they remain robust and secure to safeguard sensitive data and operations. By acknowledging the limitations of current protections and engaging with researchers and industry partners, we can work towards developing more secure solutions for the future.